AWS Private CA Pricing Calculator
Estimate CA operation hours and tiered certificate issuance before mTLS and internal PKI costs hit the security budget.
- No signup
- Instant results
- ~2 min
Rates reviewed
Your PKI footprint
us-east-1list rates, pricing as of 2026-07-09. Source: AWS public pricing.
General-purpose: $0.75 (1–1K), $0.35 (1,001–10K), $0.001 (10,001+).
Who This Tool Is For
Security and compliance leads building internal PKI for mTLS, device identity, or private API certificates in PCI and HIPAA environments.
Why We Built This Tool
Private CA operation is a flat $400/month per general-purpose CA before the first certificate — tiered issuance adds up fast at scale.
What Problem It Solves
- CA sprawl. Separate root and subordinate CAs per environment multiply the $400/month operation fee.
- Tier cliffs. Issuance drops from $0.75 to $0.35 at 1,001 certs — org-wide consolidated billing affects tier placement.
- OCSP overhead. High-volume mTLS with OCSP enabled adds $0.06/cert/month plus query fees.
Pair with our cloud security service or the KMS calculator.
Frequently Asked Questions
Where do these Private CA prices come from?
Rates are AWS published us-east-1 list prices (AWS Private CA pricing), pricing as of 2026-07-09.
General-purpose vs short-lived CA — which should I use?
Use short-lived mode when certificates are valid ≤7 days (service mesh, SPIFFE-style identity). Use general-purpose for traditional PKI with longer-lived server and client certificates.
When does Private CA beat public ACM?
Public ACM certificates are free for use with integrated AWS services but cannot issue private/internal certificates. Private CA is required for mTLS between services, on-prem devices, and private API endpoints.
How does tiered certificate pricing work?
For general-purpose CAs: $0.75 for the first 1,000 certs/month per Region, $0.35 for 1,001–10,000, and $0.001 above 10,000. Tiers aggregate across CAs in the same Region under consolidated billing.
What does OCSP cost?
OCSP is $0.06 per certificate per month when a response is generated, plus $0.20 per 100,000 OCSP queries. No charge for certificates with zero queries in a month.
Does this include CloudHSM-backed CA?
No. This calculator covers standard AWS Private CA operation and issuance. Dedicated CloudHSM clusters bill separately — see our CloudHSM pricing calculator.